I am curious about this seemingly common perception that Wordpress is an insecure product. Is Wordpress, when configured correctly, far less secure than other platforms? (My main thinking is that it is an obvious target due to its incredible marketshare)
A client I had was recently terrified of using Wordpress because an 'SEO expert' had filled her head with conjecture about the insecurity of Wordpress compared to Drupal, referring anecdotally to the White House website using Drupal as some sort of indicator that Drupal is infinitely more secure.
I'm just curious if you believe there are inherent risks in Wordpress, or if you meant specifically Wordpress in the wrong hands and with the wrong plugins/extensions etc.
I'm just curious if you believe there are inherent risks in Wordpress, or if you meant specifically Wordpress in the wrong hands and with the wrong plugins/extensions etc.
Well, in the context of submission link -- serving straight up static HTML content, you have essentially zero risk of security vulnerabilities. I meant to contrast this in a general sense with Wordpress, so I moreso did mean to imply Wordpress is insecure for both its inherent risks (fewer or greater than Drupal) and risks that come with plugins (which a significant amount of Wordpress users do end up getting).
Comments
I am curious about this seemingly common perception that Wordpress is an insecure product. Is Wordpress, when configured correctly, far less secure than other platforms? (My main thinking is that it is an obvious target due to its incredible marketshare)
A client I had was recently terrified of using Wordpress because an 'SEO expert' had filled her head with conjecture about the insecurity of Wordpress compared to Drupal, referring anecdotally to the White House website using Drupal as some sort of indicator that Drupal is infinitely more secure.
However, looking at CVE data, I don't find massive discrepancies, in fact Drupal had more listed vulnerabilities (almost double) than Wordpress in 2014. Compare the CVE statistics for Drupal http://www.cvedetails.com/vendor/1367/Drupal.html vs. Wordpress http://www.cvedetails.com/vendor/2337/Wordpress.html
I'm just curious if you believe there are inherent risks in Wordpress, or if you meant specifically Wordpress in the wrong hands and with the wrong plugins/extensions etc.
Well, in the context of submission link -- serving straight up static HTML content, you have essentially zero risk of security vulnerabilities. I meant to contrast this in a general sense with Wordpress, so I moreso did mean to imply Wordpress is insecure for both its inherent risks (fewer or greater than Drupal) and risks that come with plugins (which a significant amount of Wordpress users do end up getting).